Bug 594362 (CVE-2010-3110) - VUL-0: CVE-2010-3110: kernel: multiple overflows in novfs; local root exploit
Summary: VUL-0: CVE-2010-3110: kernel: multiple overflows in novfs; local root exploit
Status: RESOLVED FIXED
: 644888 (view as bug list)
Alias: CVE-2010-3110
Product: SUSE Security Incidents
Classification: Novell Products
Component: General (show other bugs)
Version: unspecified
Hardware: Other Linux
: P1 - Urgent : Critical
Target Milestone: ---
Deadline: 2010-09-07
Assignee: Security Team bot
QA Contact: E-mail List
URL:
Whiteboard: maint:released:sle11-sp1:34629 maint:...
Keywords:
Depends on:
Blocks:
 
Reported: 2010-04-07 13:25 UTC by Sebastian Krahmer
Modified: 2018-07-03 20:30 UTC (History)
8 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
proof of concept (440 bytes, text/plain)
2010-04-07 13:26 UTC, Sebastian Krahmer 		Details
Patch (784 bytes, patch)
2010-04-09 05:36 UTC, Forgotten User eDPGYP6_cn 		Details | Diff
PoC for stack overflow (4.93 KB, text/plain)
2010-04-12 10:45 UTC, Sebastian Krahmer 		Details
novfs-fix-sizes.patch (55.06 KB, patch)
2010-04-22 12:05 UTC, Marcus Meissner 		Details | Diff
updated patch (61.08 KB, patch)
2010-07-01 11:02 UTC, Forgotten User eDPGYP6_cn 		Details | Diff
Latest version of the patch (61.49 KB, patch)
2010-07-07 13:18 UTC, Forgotten User eDPGYP6_cn 		Details | Diff
Show Obsolete (3) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Krahmer 2010-04-07 13:25:47 UTC 
The kernel part of novfs contains plenty of buffer
overflows and integer wrap arounds.
Sample testcase attached. The whole kernel code needs review.
Comment 1 Sebastian Krahmer 2010-04-07 13:26:47 UTC 
Created attachment 352858 [details]
proof of concept

...
Comment 2 Forgotten User eDPGYP6_cn 2010-04-09 05:36:31 UTC 
Created attachment 353367 [details]
Patch

Not sure if this patch is enough. But I believe it is needed.
Comment 3 Forgotten User eDPGYP6_cn 2010-04-09 07:47:24 UTC 
BTW, this patch was generated on 11.2 sources. There is not much difference between this part of the sources except a __DbgPrint and DbgPrint. 

Review of the patch will be helpful. Thanks.
Comment 4 Sebastian Krahmer 2010-04-12 10:43:17 UTC 
I dont name any case in detail here; since overflow or wraparounds
are basically in every of the functions a user can trigger. So I try
to explain the problem in general, underlined by examples from the code.

The problem is, that the code in general trusts all the arguments it
receives from userspace.
The structs contain a lot of length arguments. The best would
be to add a reasonable-size check after each copy_from_user(),
e.g. 

uNumReplyFrags > 10000 || uNumReplyFrags <= 0

or so. Larger values would make no sense.(depending on whether its signed or not
so it could be negative)
This applies to all num or len arguments in structs passed
to kernel.
Then you are automatically safe from wrap arounds in calculations
like uNumReplyFrags*sizeof(struct nwc_frag) which is passed
to kmalloc().


Also, there is simple stack overflow in novfs_open_conn_by_addr():
        cpylen =
                copy_from_user(addr, tranAddr.puAddress,
                                tranAddr.uAddressLength);

All copy operations like this must check whether the user give len
fields exceed target buffer sizes! I attached a sample root exploit
for 11.1. On 11.2 the -fstack-protector and array re-ordering of GCC
just halts the machine, which is bad enough.

What me also worries that users could trigger kmalloc()'s of
arbitrary size and amounts since there seems no connection
limiting or whatever like the normal ulimits that kick in for sockets
or alike.
This is since the novfs code tracks all its handles by itself,
which, even worse, are also trusted from user arguments.


Maybe it would be good to have a kernel developer looking at it,
so he could give hints how to handle it best.
Comment 5 Sebastian Krahmer 2010-04-12 10:45:52 UTC 
Created attachment 353706 [details]
PoC for stack overflow

...
Comment 6 Marcus Meissner 2010-04-12 14:26:54 UTC 
jiri, jeff, just bringing this to your attention as branch owners.

Not sure if action is required from you, I would let the NOVFS guys fix this ... but perhaps advise/help is required
Comment 7 Sebastian Krahmer 2010-04-19 12:51:36 UTC 
I am currently preparing patches which I will attach when finished.
Comment 10 Marcus Meissner 2010-04-22 12:05:56 UTC 
Created attachment 356209 [details]
novfs-fix-sizes.patch

diffed tarball against 11.2 branch

i had to manually remove the meanwhile applied patches, as it was done against GA state I think.
Comment 11 Forgotten User eDPGYP6_cn 2010-05-14 11:42:20 UTC 
Assigning the bug to the team id.
Comment 12 Marcus Meissner 2010-06-16 14:52:12 UTC 
folks, please give a status update.


For other local root exploits our turnaround times are 1 week usually.


adjust prio and severity.
Comment 14 Jan Kara 2010-06-16 16:22:27 UTC 
Sankar, Sebastian, please let me know when you have the final version of the fix so that I can commit it to our kernel tree. Also quickly looking at the patch: it is unwise to reindent unrelated code while fixing some issue. It makes reading the patch much harder...
Comment 17 Forgotten User eDPGYP6_cn 2010-06-22 10:45:01 UTC 
I am currently checking out SLE 11 SP1 sources (to make the 11.2 patch appliable on that) and then will start a build with it. QA is already verifying the other security patch on novfsd. 

The main problem imho is: Different departments having different styles of security-review. novfs sources went through a security review in Workgroup but none of these were caught. novfs was shipping in SLE as well since SLED 11 and none of these were caught earlier. The best move forward will be to have a dedicated person fixing novfs issues and making it upstream-quality compliant.
Comment 18 Forgotten User eDPGYP6_cn 2010-06-23 15:00:31 UTC 
Kernel rpm with the patch for WGP QA are available at:
http://w3.suse.de/~psankar/security/ (kernel rpm)

and https://build.suse.de/project/show?project=home:psankar:branches:SUSE:SLE-11-SP1:GA 

Venkata (CCed) will be testing these rpms before I submit the patch to the kernel mailing list.
Comment 19 Forgotten User eDPGYP6_cn 2010-06-24 09:06:49 UTC 
The testing has begun and Venkata is testing the rpms already.
Comment 20 Forgotten User eDPGYP6_cn 2010-06-24 11:47:01 UTC 
After installing the kernel, keyboard and mouse stop working, just after the boot selection screen. (with the old kernel, everything was working fine)

I am looking into what I did wrong during the build. I just added my patch to patches.fixes, edited series.conf, did scripts/tar-up.sh , cd kernel-source, mbuild

I will update once I prepare another kernel rpm and test it in my machine before giving QA. I will update at the very earliest I can.
Comment 21 Forgotten User eDPGYP6_cn 2010-06-28 08:59:59 UTC 
I did a rebuild today with the new git SLE11-SP1 branch (few commits after my previous build). This build seem to work fine. So, I am handing over to the QA now.
Comment 22 Forgotten User eDPGYP6_cn 2010-06-29 07:36:21 UTC 
Login is failing with the patch. I am debugging the issue to find out which code change is causing the problem.
Comment 23 Forgotten User eDPGYP6_cn 2010-07-01 09:41:22 UTC 
I have identified some issues with our MAX error checkings, related to the NULL byte that is added by novfsd (the user space daemon). I am in the process of fixing them by using different MAX macros. I will attach the patch once I complete my work.
Comment 24 Forgotten User eDPGYP6_cn 2010-07-01 11:02:26 UTC 
Created attachment 373187 [details]
updated patch
Comment 25 Forgotten User eDPGYP6_cn 2010-07-01 11:04:40 UTC 
I am preparing the RPMs now which the QA will be testing and approving. After this, if there are no other issues(hopefully, as I've tested good in my machine), I will submit the patch to kernel@suse.de
Comment 26 Forgotten User eDPGYP6_cn 2010-07-06 06:29:22 UTC 
The testing is going on and there was a holiday in India yesterday. I have the patch ready and will do: git send-mail once the QA approves. Thanks.
Comment 27 Forgotten User eDPGYP6_cn 2010-07-07 13:17:18 UTC 
The QA has found that with 64 bit machines, after the patch is applied, browsing NCP volumes via Nautilus leads to a machine hang. So, I am looking at debugging this issue now.
Comment 28 Forgotten User eDPGYP6_cn 2010-07-07 13:18:44 UTC 
Created attachment 374262 [details]
Latest version of the patch
Comment 29 Forgotten User eDPGYP6_cn 2010-07-12 07:10:10 UTC 
The nautilus hang issue was observed in only one folder. This was not a regression becuase of the security fix, as it was observed with an unpatched kernel as well. So that hang need not block the security fix. I have just sent the security patch for review/commit to Jan Kara and kernel@suse.de 

Thanks to Sebastian Krahmer and Marcus Meissner for the detailed security review.
Comment 30 Jan Kara 2010-07-12 13:58:03 UTC 
I've committed the fix to SLE11-SP1 branch.
Comment 31 Forgotten User eDPGYP6_cn 2010-07-14 06:37:51 UTC 
Marking the bug as RESOLVED FIXED as the patch is in our version control system. Thanks to everyone involved.
Comment 32 Marcus Meissner 2010-07-14 11:29:23 UTC 
reopen and reassign to us for tracking.

(cves etc.)
Comment 33 Swamp Workflow Management 2010-07-21 09:07:11 UTC 
The SWAMPID for this issue is 34625.
This issue was rated as critical.
Please submit fixed packages as soon as possible.
When done, please reassign the bug to security-team@suse.de.
Patchinfo will be handled by security team.
Comment 34 Marcus Meissner 2010-08-02 11:58:04 UTC 
A kernel update for SUSE Linux Enterprise 11 SP1 was just released that
mentions/fixes this bug. The released version is 2.6.32.13-0.5.1.
Comment 35 Swamp Workflow Management 2010-08-02 14:09:04 UTC 
Update released for: kernel-default-extra
Products:
SLE-SERVER 11-EXTRA (ia64)
Comment 36 Swamp Workflow Management 2010-08-02 14:10:38 UTC 
Update released for: btrfs-kmp-default, cluster-network-kmp-default, ext4dev-kmp-default, gfs2-kmp-default, kernel-default, kernel-default-base, kernel-default-debuginfo, kernel-default-debugsource, kernel-default-devel, kernel-default-devel-debuginfo, kernel-default-extra, kernel-source, kernel-source-debuginfo, kernel-source-vanilla, kernel-syms, kernel-trace, kernel-trace-base, kernel-trace-debuginfo, kernel-trace-debugsource, kernel-trace-devel, kernel-trace-devel-debuginfo, kernel-trace-extra
Products:
SLE-DEBUGINFO 11-SP1 (ia64)
SLE-HAE 11-SP1 (ia64)
SLE-SERVER 11-SP1 (ia64)
Comment 37 Swamp Workflow Management 2010-08-02 14:11:44 UTC 
Update released for: kernel-default-extra, kernel-xen-extra
Products:
SLE-SERVER 11-EXTRA (x86_64)
Comment 38 Swamp Workflow Management 2010-08-02 14:13:20 UTC 
Update released for: kernel-default-extra, kernel-ppc64-extra
Products:
SLE-SERVER 11-EXTRA (ppc64)
Comment 39 Swamp Workflow Management 2010-08-02 14:14:31 UTC 
Update released for: kernel-default-extra, kernel-pae-extra, kernel-xen-extra
Products:
SLE-SERVER 11-EXTRA (i386)
Comment 40 Swamp Workflow Management 2010-08-02 14:16:29 UTC 
Update released for: btrfs-kmp-default, btrfs-kmp-pae, btrfs-kmp-xen, cluster-network-kmp-default, cluster-network-kmp-pae, cluster-network-kmp-xen, ext4dev-kmp-default, ext4dev-kmp-pae, ext4dev-kmp-xen, gfs2-kmp-default, gfs2-kmp-pae, gfs2-kmp-xen, hyper-v-kmp-default, hyper-v-kmp-pae, kernel-default, kernel-default-base, kernel-default-debuginfo, kernel-default-debugsource, kernel-default-devel, kernel-default-extra, kernel-desktop-devel, kernel-pae, kernel-pae-base, kernel-pae-debuginfo, kernel-pae-debugsource, kernel-pae-devel, kernel-pae-extra, kernel-source, kernel-source-debuginfo, kernel-source-vanilla, kernel-syms, kernel-trace, kernel-trace-base, kernel-trace-devel, kernel-trace-extra, kernel-xen, kernel-xen-base, kernel-xen-debuginfo, kernel-xen-debugsource, kernel-xen-devel, kernel-xen-extra
Products:
SLE-DEBUGINFO 11-SP1 (i386)
SLE-DESKTOP 11-SP1 (i386)
SLE-HAE 11-SP1 (i386)
SLE-SERVER 11-SP1 (i386)
Comment 41 Swamp Workflow Management 2010-08-02 14:18:05 UTC 
Update released for: kernel-default-extra
Products:
SLE-SERVER 11-EXTRA (s390x)
Comment 42 Swamp Workflow Management 2010-08-02 14:19:03 UTC 
Update released for: btrfs-kmp-default, cluster-network-kmp-default, ext4dev-kmp-default, gfs2-kmp-default, kernel-default, kernel-default-base, kernel-default-debuginfo, kernel-default-debugsource, kernel-default-devel, kernel-default-devel-debuginfo, kernel-default-extra, kernel-default-man, kernel-source, kernel-source-debuginfo, kernel-source-vanilla, kernel-syms, kernel-trace, kernel-trace-base, kernel-trace-debuginfo, kernel-trace-debugsource, kernel-trace-devel, kernel-trace-devel-debuginfo, kernel-trace-extra, kernel-trace-man
Products:
SLE-DEBUGINFO 11-SP1 (s390x)
SLE-HAE 11-SP1 (s390x)
SLE-SERVER 11-SP1 (s390x)
Comment 43 Swamp Workflow Management 2010-08-02 14:20:30 UTC 
Update released for: btrfs-kmp-default, btrfs-kmp-ppc64, cluster-network-kmp-default, cluster-network-kmp-ppc64, ext4dev-kmp-default, ext4dev-kmp-ppc64, gfs2-kmp-default, gfs2-kmp-ppc64, kernel-default, kernel-default-base, kernel-default-debuginfo, kernel-default-debugsource, kernel-default-devel, kernel-default-extra, kernel-kdump, kernel-kdump-debuginfo, kernel-kdump-debugsource, kernel-ppc64, kernel-ppc64-base, kernel-ppc64-debuginfo, kernel-ppc64-debugsource, kernel-ppc64-devel, kernel-ppc64-extra, kernel-source, kernel-source-debuginfo, kernel-source-vanilla, kernel-syms, kernel-trace, kernel-trace-base, kernel-trace-debuginfo, kernel-trace-debugsource, kernel-trace-devel, kernel-trace-extra
Products:
SLE-DEBUGINFO 11-SP1 (ppc64)
SLE-HAE 11-SP1 (ppc64)
SLE-SERVER 11-SP1 (ppc64)
Comment 44 Swamp Workflow Management 2010-08-02 14:21:47 UTC 
Update released for: btrfs-kmp-default, btrfs-kmp-xen, cluster-network-kmp-default, cluster-network-kmp-xen, ext4dev-kmp-default, ext4dev-kmp-xen, gfs2-kmp-default, gfs2-kmp-xen, hyper-v-kmp-default, kernel-default, kernel-default-base, kernel-default-debuginfo, kernel-default-debugsource, kernel-default-devel, kernel-default-devel-debuginfo, kernel-default-extra, kernel-desktop-devel, kernel-source, kernel-source-debuginfo, kernel-source-vanilla, kernel-syms, kernel-trace, kernel-trace-base, kernel-trace-debuginfo, kernel-trace-debugsource, kernel-trace-devel, kernel-trace-devel-debuginfo, kernel-trace-extra, kernel-xen, kernel-xen-base, kernel-xen-debuginfo, kernel-xen-debugsource, kernel-xen-devel, kernel-xen-devel-debuginfo, kernel-xen-extra
Products:
SLE-DEBUGINFO 11-SP1 (x86_64)
SLE-DESKTOP 11-SP1 (x86_64)
SLE-HAE 11-SP1 (x86_64)
SLE-SERVER 11-SP1 (x86_64)
Comment 45 Swamp Workflow Management 2010-08-24 15:22:56 UTC 
The SWAMPID for this issue is 35398.
This issue was rated as moderate.
Please submit fixed packages until 2010-09-07.
When done, please reassign the bug to security-team@suse.de.
Patchinfo will be handled by security team.
Comment 46 Ludwig Nussel 2010-08-25 07:19:18 UTC 
CVE-2010-3110
Comment 47 Swamp Workflow Management 2010-09-08 13:08:23 UTC 
Update released for: kernel-debug, kernel-debug-base, kernel-debug-base-debuginfo, kernel-debug-debuginfo, kernel-debug-debugsource, kernel-debug-devel, kernel-debug-devel-debuginfo, kernel-default, kernel-default-base, kernel-default-base-debuginfo, kernel-default-debuginfo, kernel-default-debugsource, kernel-default-devel, kernel-default-devel-debuginfo, kernel-desktop, kernel-desktop-base, kernel-desktop-base-debuginfo, kernel-desktop-debuginfo, kernel-desktop-debugsource, kernel-desktop-devel, kernel-desktop-devel-debuginfo, kernel-devel, kernel-ec2-devel, kernel-pae, kernel-pae-base, kernel-pae-base-debuginfo, kernel-pae-debuginfo, kernel-pae-debugsource, kernel-pae-devel, kernel-pae-devel-debuginfo, kernel-source, kernel-source-vanilla, kernel-syms, kernel-trace, kernel-trace-base, kernel-trace-base-debuginfo, kernel-trace-debuginfo, kernel-trace-debugsource, kernel-trace-devel, kernel-trace-devel-debuginfo, kernel-vanilla, kernel-vanilla-base, kernel-vanilla-base-debuginfo, kernel-vanilla-debuginfo, kernel-vanilla-debugsource, kernel-vanilla-devel, kernel-vanilla-devel-debuginfo, kernel-vmi-devel, kernel-xen, kernel-xen-base, kernel-xen-base-debuginfo, kernel-xen-debuginfo, kernel-xen-debugsource, kernel-xen-devel, kernel-xen-devel-debuginfo, preload-kmp-default, preload-kmp-desktop
Products:
openSUSE 11.3 (debug, i586, x86_64)
Comment 48 Marcus Meissner 2010-09-27 10:54:51 UTC 
all currently interesting done I think.
Comment 49 Ludwig Nussel 2010-10-11 07:09:54 UTC 
*** Bug 644888 has been marked as a duplicate of this bug. ***